{"id":"CVE-2026-113743","title":"Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal","summary":"A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-22"],"vendor":"Tenstorrent","product":"tt-metal","affected":["tt-metal 0.1","tt-metal 0.2","tt-metal 0.3","tt-metal 0.4","tt-metal 0.5","tt-metal 0.6","tt-metal 0.7","tt-metal 0.8","tt-metal 0.9","tt-metal 0.10","tt-metal 0.11","tt-metal 0.12","tt-metal 0.13","tt-metal 0.14","tt-metal 0.15","tt-metal 0.16","tt-metal 0.17","tt-metal 0.18","tt-metal 0.19","tt-metal 0.20","tt-metal 0.21","tt-metal 0.22","tt-metal 0.23","tt-metal 0.24","tt-metal 0.25","tt-metal 0.26","tt-metal 0.27","tt-metal 0.28","tt-metal 0.29","tt-metal 0.30","tt-metal 0.31","tt-metal 0.32","tt-metal 0.33","tt-metal 0.34","tt-metal 0.35","tt-metal 0.36","tt-metal 0.37","tt-metal 0.38","tt-metal 0.39","tt-metal 0.40","tt-metal 0.41","tt-metal 0.42","tt-metal 0.43","tt-metal 0.44","tt-metal 0.45","tt-metal 0.46","tt-metal 0.47","tt-metal 0.48","tt-metal 0.49","tt-metal 0.50"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T01:15:29.254Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113743","references":[{"url":"https://vuldb.com/vuln/422924","label":"VDB-422924 | Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal"},{"url":"https://vuldb.com/vuln/422924/cti","label":"VDB-422924 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-113743","label":"CVE-2026-113743 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1018296","label":"Submit #1018296 | Tenstorrent tt-metal up to 0.79.0 Path Traversal"},{"url":"https://github.com/tenstorrent/tt-metal/issues/59616"},{"url":"https://github.com/tenstorrent/tt-metal/pull/60634"},{"url":"https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_tt-metal_tt_transformers_load_checkpoints.md"},{"url":"https://github.com/tenstorrent/tt-metal/commit/4851ccf347f6903c3d819eed60705600386e52c3"},{"url":"https://github.com/tenstorrent/tt-metal/releases/tag/v0.81.0-dev20261016"},{"url":"https://github.com/tenstorrent/tt-metal/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:07.999Z","slug":"CVE-2026-113743","body":"## Overview\n\nA weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.\n\n## Affected\n\n- `tt-metal 0.1`\n- `tt-metal 0.2`\n- `tt-metal 0.3`\n- `tt-metal 0.4`\n- `tt-metal 0.5`\n- `tt-metal 0.6`\n- `tt-metal 0.7`\n- `tt-metal 0.8`\n- `tt-metal 0.9`\n- `tt-metal 0.10`\n- `tt-metal 0.11`\n- `tt-metal 0.12`\n- `tt-metal 0.13`\n- `tt-metal 0.14`\n- `tt-metal 0.15`\n- `tt-metal 0.16`\n- `tt-metal 0.17`\n- `tt-metal 0.18`\n- `tt-metal 0.19`\n- `tt-metal 0.20`\n- `tt-metal 0.21`\n- `tt-metal 0.22`\n- `tt-metal 0.23`\n- `tt-metal 0.24`\n- `tt-metal 0.25`\n- `tt-metal 0.26`\n- `tt-metal 0.27`\n- `tt-metal 0.28`\n- `tt-metal 0.29`\n- `tt-metal 0.30`\n- `tt-metal 0.31`\n- `tt-metal 0.32`\n- `tt-metal 0.33`\n- `tt-metal 0.34`\n- `tt-metal 0.35`\n- `tt-metal 0.36`\n- `tt-metal 0.37`\n- `tt-metal 0.38`\n- `tt-metal 0.39`\n- `tt-metal 0.40`\n- `tt-metal 0.41`\n- `tt-metal 0.42`\n- `tt-metal 0.43`\n- `tt-metal 0.44`\n- `tt-metal 0.45`\n- `tt-metal 0.46`\n- `tt-metal 0.47`\n- `tt-metal 0.48`\n- `tt-metal 0.49`\n- `tt-metal 0.50`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}